Self-Service Single Sign-On

Self-Service Single Sign-On (SSO) provides business-to-business customers with the tools needed to delegate SSO setup to their enterprise customers. By delegating this task, you can streamline your onboarding process and grant customers more autonomy over their sign-on experience. You can also reduce the time and costs associated with managing SSO across your customer base. 

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an Enterprise connection.

Supported Providers

During the Early Access period, Self-Service SSO supports the following identity providers:

  • Okta Workforce Identity Cloud (using OIDC)

  • Entra ID

  • Google Workspace (using OIDC)

  • Keycloak

  • Microsoft Active Directory Federation Services (ADFS)

  • Generic OIDC

  • Generic SAML

How it works

Self-Service SSO uses the following components to delegate setup to your customers:

  • Self-service profile: Defines key elements of customer SSO implementations, such as the identity providers they can use for SSO and which user attributes they must capture, such as email.

  • Self-service access ticket: Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration.

  • SSO setup assistant: Guides customer admins through the SSO setup process.

At a high level, the Self-Service SSO workflow includes the following tasks: 

  1. You (the Auth0 customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API. 

  2. Using the Management API, you next create a self-service access ticket that allows customer admins to configure SSO. 

  3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.

  4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider. 

  5. A new Enterprise connection pointing to the customer’s application is added to your Auth0 tenant.

Workflow diagram for the Self-Service SSO feature.

Select the diagram for an expanded view.

Using Self-Service SSO

The sections below provide expanded steps for configuring a self-service profile in your tenant and creating self-service access tickets to share with customer admins.

Create a self-service profile

You can create self-service profiles using the Auth0 Dashboard or the Management API. Self-service profiles are used to determine key elements of customer implementations, including:

  • Which identity providers customer admins can use for SSO.

  • Which user attributes they must capture through SSO, such as email or family name.

  • Branding options that customize the look and feel of the SSO setup assistant.

You can create multiple profiles as needed to accommodate different customers or segments.

To create a self-service profile on the Auth0 Dashboard:

  1. Navigate to Authentication > Enterprise and open the Self-Service SSO section. Then, select Create Profile.

  2. In the space provided, enter a name and optional description for the profile. Then, select Create.

  3. On the Settings tab, complete the sections below. After updating these sections, select Save.

    • Identity Providers: Enable one or more identity providers. In the SSO setup assistant, customer admins can select their preferred option from the list of enabled providers.

    • Branding: Provide a logo and primary color for the SSO setup assistant.

  4. On the User Profile tab, add up to 20 user attributes that your customers should capture through SSO, such as email or family name. You can set each attribute as required or optional.

    • During the setup assistant flow, customer admins will be prompted to map these defined user attributes to their identity provider to ensure the necessary values are passed to Auth0.

Create self-service access ticket

After creating your self-service profile, you can create a self-service access ticket using the Management API. This ticket provides a customer admin with access to the SSO setup assistant.

  1. Retrieve the ID of the self-service profile you created for your tenant using the Retrieve Self-Service Profiles endpoint.

  2. Call the SSO Access Ticket endpoint using the ID of the self-service profile you previously created in your tenant:

POST  /api/v2/self-service-profiles/{id}/sso-ticket

In the request body, specify the following parameters:

Parameter Description
connection_config Object.

Provide this option when using an access ticket to create a new SSO connection. connection_config cannot be used in tandem with connection_id.
connection_config.name String. Maximum length is 128.

Name for the connection created through the SSO setup assistant.

Use of this parameter is required when using connection_config.
connection_id String.

Provide this option when using an access ticket to update an existing SSO connection. connection_id cannot be used in tandem with connection_config.

ID for the connection that will be updated through the SSO setup assistant. You can retrieve connection IDs through the Authentication section of the Auth0 Dashboard or the Get All Connections endpoint.
enabled_clients String[].

A list of application client IDs to associate with the SSO connection.
enabled_organizations Object[].

A list of organizations to associate with the SSO connection.
enabled_organizations[].organization_id ID of a specific organization to associate with the SSO connection.

You can retrieve IDs through the Organizations section of the Auth0 Dashboard, the Get Organizations endpoint, or the Get Organization by Name endpoint.

Use of this parameter is required when using enabled_organizations.

Example Request Body

{
  "connection_id": "con_PzXxgqxYD1QryUT2",
  "connection_config": {
    "name": "sso-generated-SAML-customer-12"
  },
  "enabled_clients": [
    "NaByIDEzMQErqouDb9DWGZSOlqhR8JgO",
    "SFwh3of2k09hfywg7lfBTEnEPqZPm0S3
  ],
  "enabled_organizations": [
    {
      "organization_id": "org_mrW0HjyX5kAfccO6"
    },
    {
      "organization_id": "org_C5NbiK4QBbNc15Yu"
    }
  ]
}

Was this helpful?

/

In response, you receive a URL to the self-service access ticket:

{
  "ticket": "https://{domain}/self-service/connections-flow?ticket={id}"
}

Was this helpful?

/

Share this URL with your customer admin to grant them access to the SSO setup assistant. The assistant will then guide them through each step of the SSO setup process.

You can choose to wrap ticket generation in your own self-service portal or send access ticket links to customer admins through email, chat, or another communication channel.

References

APIs

To manage Self-Service SSO, the following Management API endpoints are available:

Rate Limits

When using Self-Service SSO, the following rate limits apply:

Description Endpoint Limits
Manage SSO profiles /api/v2/self-service-profiles Review the Management API rate limits for your subscription type.
Create an access ticket /api/v2/self-service-profiles/{id}/sso-ticket Review the Management API rate limits for your subscription type.
Consume an access ticket /self-service/connection-flows?ticket={id} 6 / min / IP
Load the webapp (including setup assistant) and webapp endpoints /self-service/* 50 / min / IP
90 / min / tenant